Browse Source
Nova vairants (Ova) NIFS abstraction (#165)
* add NIFS trait abstraction (based on the needs for Nova, Mova, Ova), defining a common interface between the three Nova variants The recent Ova NIFS PR #163 (https://github.com/privacy-scaling-explorations/sonobe/pull/163) and Mova NIFS PR #161 (https://github.com/privacy-scaling-explorations/sonobe/pull/161) PRs add Nova NIFS variants implementations which differ from Nova in the logic done for the `E` error terms of the instances. The current Ova implementation (https://github.com/privacy-scaling-explorations/sonobe/pull/163) is based on the existing Nova NIFS code base and adds the modifications to the `E` logic on top of it, and thus duplicating the code. Similarly for the Mova NIFS impl. The rest of the Mova & Ova schemes logic that is not yet implemented is pretty similar to Nova one (ie. the IVC logic, the circuits and the Decider), so ideally that can be done reusing most of the already existing Nova code without duplicating it. This PR is a first step in that direction for the existing Ova NIFS code. This commit adds the NIFS trait abstraction with the idea of allowing to reduce the amount of duplicated code for the Ova's NIFS impl on top of the Nova's code. * add Ova variant on top of the new NIFS trait abstraction This is done from the existing Ova implementation at `folding/ova/{mod.rs,nofs.rs}`, but removing when possible code that is not needed or duplicated from the Nova logic. * rm old Ova duplicated code This commit combined with the other ones (add nifs abstraction & port Ova to the nifs abstraction) allows to effectively get rid of ~400 lines of code that were duplicated in the Ova NIFS impl from the Nova impl. * small polishing & rebase to latest `main` branch updatesmain
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
14 changed files with 640 additions and 1075 deletions
Unified View
Diff Options
-
+27 -9folding-schemes/src/folding/circuits/cyclefold.rs
-
+0 -1folding-schemes/src/folding/mod.rs
-
+50 -29folding-schemes/src/folding/nova/circuits.rs
-
+1 -1folding-schemes/src/folding/nova/decider.rs
-
+9 -9folding-schemes/src/folding/nova/decider_circuits.rs
-
+1 -0folding-schemes/src/folding/nova/decider_eth.rs
-
+11 -9folding-schemes/src/folding/nova/decider_eth_circuit.rs
-
+15 -13folding-schemes/src/folding/nova/mod.rs
-
+168 -315folding-schemes/src/folding/nova/nifs.rs
-
+269 -0folding-schemes/src/folding/nova/ova.rs
-
+73 -24folding-schemes/src/folding/nova/traits.rs
-
+16 -26folding-schemes/src/folding/nova/zk.rs
-
+0 -157folding-schemes/src/folding/ova/mod.rs
-
+0 -482folding-schemes/src/folding/ova/nifs.rs
@ -1,6 +1,5 @@ |
|||||
pub mod circuits;
|
pub mod circuits;
|
||||
pub mod hypernova;
|
pub mod hypernova;
|
||||
pub mod nova;
|
pub mod nova;
|
||||
pub mod ova;
|
|
||||
pub mod protogalaxy;
|
pub mod protogalaxy;
|
||||
pub mod traits;
|
pub mod traits;
|
||||
@ -0,0 +1,269 @@ |
|||||
|
/// This module contains the implementation the NIFSTrait for the
|
||||
|
/// [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw) NIFS (Non-Interactive Folding Scheme) as
|
||||
|
/// outlined in the protocol description doc:
|
||||
|
/// <https://hackmd.io/V4838nnlRKal9ZiTHiGYzw#Construction> authored by Benedikt Bünz.
|
||||
|
use ark_crypto_primitives::sponge::Absorb;
|
||||
|
use ark_ec::{CurveGroup, Group};
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_serialize::{CanonicalDeserialize, CanonicalSerialize};
|
||||
|
use ark_std::fmt::Debug;
|
||||
|
use ark_std::rand::RngCore;
|
||||
|
use ark_std::{One, UniformRand, Zero};
|
||||
|
use std::marker::PhantomData;
|
||||
|
|
||||
|
use super::{circuits::ChallengeGadget, traits::NIFSTrait};
|
||||
|
use crate::arith::r1cs::R1CS;
|
||||
|
use crate::commitment::CommitmentScheme;
|
||||
|
use crate::folding::{circuits::CF1, traits::Dummy};
|
||||
|
use crate::transcript::{AbsorbNonNative, Transcript};
|
||||
|
use crate::utils::vec::{hadamard, mat_vec_mul, vec_scalar_mul, vec_sub};
|
||||
|
use crate::Error;
|
||||
|
|
||||
|
/// A CommittedInstance in [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw) is represented by `W` or
|
||||
|
/// `W'`. It is the result of the commitment to a vector that contains the witness `w` concatenated
|
||||
|
/// with `t` or `e` + the public inputs `x` and a relaxation factor `u`. (Notice that in the Ova
|
||||
|
/// document `u` is denoted as `mu`, in this implementation we use `u` so it follows the original
|
||||
|
/// Nova notation, so code is easier to follow).
|
||||
|
#[derive(Debug, Clone, Eq, PartialEq, CanonicalSerialize, CanonicalDeserialize)]
|
||||
|
pub struct CommittedInstance<C: CurveGroup> {
|
||||
|
pub u: C::ScalarField, // in the Ova document is denoted as `mu`
|
||||
|
pub x: Vec<C::ScalarField>,
|
||||
|
pub cmWE: C,
|
||||
|
}
|
||||
|
|
||||
|
impl<C: CurveGroup> Absorb for CommittedInstance<C>
|
||||
|
where
|
||||
|
C::ScalarField: Absorb,
|
||||
|
{
|
||||
|
fn to_sponge_bytes(&self, dest: &mut Vec<u8>) {
|
||||
|
C::ScalarField::batch_to_sponge_bytes(&self.to_sponge_field_elements_as_vec(), dest);
|
||||
|
}
|
||||
|
|
||||
|
fn to_sponge_field_elements<F: PrimeField>(&self, dest: &mut Vec<F>) {
|
||||
|
self.u.to_sponge_field_elements(dest);
|
||||
|
self.x.to_sponge_field_elements(dest);
|
||||
|
// We cannot call `to_native_sponge_field_elements(dest)` directly, as
|
||||
|
// `to_native_sponge_field_elements` needs `F` to be `C::ScalarField`,
|
||||
|
// but here `F` is a generic `PrimeField`.
|
||||
|
self.cmWE
|
||||
|
.to_native_sponge_field_elements_as_vec()
|
||||
|
.to_sponge_field_elements(dest);
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
// #[allow(dead_code)] // Clippy flag needed for now.
|
||||
|
/// A Witness in Ova is represented by `w`. It also contains a blinder which can or not be used
|
||||
|
/// when committing to the witness itself.
|
||||
|
#[derive(Debug, Clone, Eq, PartialEq, CanonicalSerialize, CanonicalDeserialize)]
|
||||
|
pub struct Witness<C: CurveGroup> {
|
||||
|
pub w: Vec<C::ScalarField>,
|
||||
|
pub rW: C::ScalarField,
|
||||
|
}
|
||||
|
|
||||
|
impl<C: CurveGroup> Witness<C> {
|
||||
|
/// Generates a new `Witness` instance from a given witness vector.
|
||||
|
/// If `H = true`, then we assume we want to blind it at commitment time,
|
||||
|
/// hence sampling `rW` from the randomness passed.
|
||||
|
pub fn new<const H: bool>(w: Vec<C::ScalarField>, mut rng: impl RngCore) -> Self {
|
||||
|
Self {
|
||||
|
w,
|
||||
|
rW: if H {
|
||||
|
C::ScalarField::rand(&mut rng)
|
||||
|
} else {
|
||||
|
C::ScalarField::zero()
|
||||
|
},
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// Given `x` (public inputs) and `t` or `e` (which we always concatenate in Ova) and the
|
||||
|
/// public inputs `x`, generates a [`CommittedInstance`] as a result which will or not be
|
||||
|
/// blinded depending on how the const generic `HC` is set up.
|
||||
|
pub fn commit<CS: CommitmentScheme<C, HC>, const HC: bool>(
|
||||
|
&self,
|
||||
|
params: &CS::ProverParams,
|
||||
|
x: Vec<C::ScalarField>,
|
||||
|
t_or_e: Vec<C::ScalarField>,
|
||||
|
) -> Result<CommittedInstance<C>, Error> {
|
||||
|
let cmWE = CS::commit(params, &[self.w.clone(), t_or_e].concat(), &self.rW)?;
|
||||
|
Ok(CommittedInstance {
|
||||
|
u: C::ScalarField::one(),
|
||||
|
cmWE,
|
||||
|
x,
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl<C: CurveGroup> Dummy<&R1CS<CF1<C>>> for Witness<C> {
|
||||
|
fn dummy(r1cs: &R1CS<CF1<C>>) -> Self {
|
||||
|
Self {
|
||||
|
w: vec![C::ScalarField::zero(); r1cs.A.n_cols - 1 - r1cs.l],
|
||||
|
rW: C::ScalarField::zero(),
|
||||
|
}
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// Implements the NIFS (Non-Interactive Folding Scheme) trait for Ova.
|
||||
|
pub struct NIFS<C: CurveGroup, CS: CommitmentScheme<C, H>, const H: bool = false> {
|
||||
|
_c: PhantomData<C>,
|
||||
|
_cp: PhantomData<CS>,
|
||||
|
}
|
||||
|
|
||||
|
impl<C: CurveGroup, CS: CommitmentScheme<C, H>, const H: bool> NIFSTrait<C, CS, H>
|
||||
|
for NIFS<C, CS, H>
|
||||
|
where
|
||||
|
<C as Group>::ScalarField: Absorb,
|
||||
|
<C as CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
type CommittedInstance = CommittedInstance<C>;
|
||||
|
type Witness = Witness<C>;
|
||||
|
type ProverAux = ();
|
||||
|
type VerifierAux = ();
|
||||
|
|
||||
|
fn new_witness(w: Vec<C::ScalarField>, _e_len: usize, rng: impl RngCore) -> Self::Witness {
|
||||
|
Witness::new::<H>(w, rng)
|
||||
|
}
|
||||
|
|
||||
|
fn new_instance(
|
||||
|
W: &Self::Witness,
|
||||
|
params: &CS::ProverParams,
|
||||
|
x: Vec<C::ScalarField>,
|
||||
|
aux: Vec<C::ScalarField>, // t_or_e
|
||||
|
) -> Result<Self::CommittedInstance, Error> {
|
||||
|
W.commit::<CS, H>(params, x, aux)
|
||||
|
}
|
||||
|
|
||||
|
fn fold_witness(
|
||||
|
r: C::ScalarField, // in Ova's hackmd denoted as `alpha`
|
||||
|
W_i: &Self::Witness,
|
||||
|
w_i: &Self::Witness,
|
||||
|
_aux: &Self::ProverAux,
|
||||
|
) -> Result<Self::Witness, Error> {
|
||||
|
let w: Vec<C::ScalarField> = W_i
|
||||
|
.w
|
||||
|
.iter()
|
||||
|
.zip(&w_i.w)
|
||||
|
.map(|(a, b)| *a + (r * b))
|
||||
|
.collect();
|
||||
|
|
||||
|
let rW = W_i.rW + r * w_i.rW;
|
||||
|
Ok(Self::Witness { w, rW })
|
||||
|
}
|
||||
|
|
||||
|
fn compute_aux(
|
||||
|
_cs_prover_params: &CS::ProverParams,
|
||||
|
_r1cs: &R1CS<C::ScalarField>,
|
||||
|
_W_i: &Self::Witness,
|
||||
|
_U_i: &Self::CommittedInstance,
|
||||
|
_w_i: &Self::Witness,
|
||||
|
_u_i: &Self::CommittedInstance,
|
||||
|
) -> Result<(Self::ProverAux, Self::VerifierAux), Error> {
|
||||
|
Ok(((), ()))
|
||||
|
}
|
||||
|
|
||||
|
fn get_challenge<T: Transcript<C::ScalarField>>(
|
||||
|
transcript: &mut T,
|
||||
|
pp_hash: C::ScalarField, // public params hash
|
||||
|
U_i: &Self::CommittedInstance,
|
||||
|
u_i: &Self::CommittedInstance,
|
||||
|
_aux: &Self::VerifierAux,
|
||||
|
) -> Vec<bool> {
|
||||
|
// reuse Nova's get_challenge method
|
||||
|
ChallengeGadget::<C, Self::CommittedInstance>::get_challenge_native(
|
||||
|
transcript, pp_hash, U_i, u_i, None, // empty in Ova's case
|
||||
|
)
|
||||
|
}
|
||||
|
|
||||
|
// Notice: `prove` method is implemented at the trait level.
|
||||
|
|
||||
|
fn verify(
|
||||
|
// r comes from the transcript, and is a n-bit (N_BITS_CHALLENGE) element
|
||||
|
r: C::ScalarField,
|
||||
|
U_i: &Self::CommittedInstance,
|
||||
|
u_i: &Self::CommittedInstance,
|
||||
|
_aux: &Self::VerifierAux,
|
||||
|
) -> Self::CommittedInstance {
|
||||
|
// recall that r <==> alpha, and u <==> mu between Nova and Ova respectively
|
||||
|
let u = U_i.u + r; // u_i.u is always 1 IN ova as we just can do sequential IVC.
|
||||
|
let cmWE = U_i.cmWE + u_i.cmWE.mul(r);
|
||||
|
let x = U_i
|
||||
|
.x
|
||||
|
.iter()
|
||||
|
.zip(&u_i.x)
|
||||
|
.map(|(a, b)| *a + (r * b))
|
||||
|
.collect::<Vec<C::ScalarField>>();
|
||||
|
|
||||
|
Self::CommittedInstance { cmWE, u, x }
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// Computes the E parameter (error terms) for the given R1CS and the instance's z and u. This
|
||||
|
/// method is used by the verifier to obtain E in order to check the RelaxedR1CS relation.
|
||||
|
pub fn compute_E<C: CurveGroup>(
|
||||
|
r1cs: &R1CS<C::ScalarField>,
|
||||
|
z: &[C::ScalarField],
|
||||
|
u: C::ScalarField,
|
||||
|
) -> Result<Vec<C::ScalarField>, Error> {
|
||||
|
let (A, B, C) = (r1cs.A.clone(), r1cs.B.clone(), r1cs.C.clone());
|
||||
|
|
||||
|
// this is parallelizable (for the future)
|
||||
|
let Az = mat_vec_mul(&A, z)?;
|
||||
|
let Bz = mat_vec_mul(&B, z)?;
|
||||
|
let Cz = mat_vec_mul(&C, z)?;
|
||||
|
|
||||
|
let Az_Bz = hadamard(&Az, &Bz)?;
|
||||
|
let uCz = vec_scalar_mul(&Cz, &u);
|
||||
|
|
||||
|
vec_sub(&Az_Bz, &uCz)
|
||||
|
}
|
||||
|
|
||||
|
#[cfg(test)]
|
||||
|
pub mod tests {
|
||||
|
use super::*;
|
||||
|
use ark_pallas::{Fr, Projective};
|
||||
|
|
||||
|
use crate::arith::{r1cs::tests::get_test_r1cs, Arith};
|
||||
|
use crate::commitment::pedersen::Pedersen;
|
||||
|
use crate::folding::nova::nifs::tests::test_nifs_opt;
|
||||
|
|
||||
|
// Simple auxiliary structure mainly used to help pass a witness for which we can check
|
||||
|
// easily an R1CS relation.
|
||||
|
// Notice that checking it requires us to have `E` as per [`Arith`] trait definition.
|
||||
|
// But since we don't hold `E` nor `e` within the NIFS, we create this structure to pass
|
||||
|
// `e` such that the check can be done.
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub(crate) struct TestingWitness<C: CurveGroup> {
|
||||
|
pub(crate) w: Vec<C::ScalarField>,
|
||||
|
pub(crate) e: Vec<C::ScalarField>,
|
||||
|
}
|
||||
|
impl<C: CurveGroup> Arith<TestingWitness<C>, CommittedInstance<C>> for R1CS<CF1<C>> {
|
||||
|
type Evaluation = Vec<CF1<C>>;
|
||||
|
|
||||
|
fn eval_relation(
|
||||
|
&self,
|
||||
|
w: &TestingWitness<C>,
|
||||
|
u: &CommittedInstance<C>,
|
||||
|
) -> Result<Self::Evaluation, Error> {
|
||||
|
self.eval_at_z(&[&[u.u], u.x.as_slice(), &w.w].concat())
|
||||
|
}
|
||||
|
|
||||
|
fn check_evaluation(
|
||||
|
w: &TestingWitness<C>,
|
||||
|
_u: &CommittedInstance<C>,
|
||||
|
e: Self::Evaluation,
|
||||
|
) -> Result<(), Error> {
|
||||
|
(w.e == e).then_some(()).ok_or(Error::NotSatisfied)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
#[test]
|
||||
|
fn test_nifs_ova() {
|
||||
|
let (W, U) = test_nifs_opt::<NIFS<Projective, Pedersen<Projective>>>();
|
||||
|
|
||||
|
// check the last folded instance relation
|
||||
|
let r1cs = get_test_r1cs();
|
||||
|
let z: Vec<Fr> = [&[U.u][..], &U.x, &W.w].concat();
|
||||
|
let e = compute_E::<Projective>(&r1cs, &z, U.u).unwrap();
|
||||
|
r1cs.check_relation(&TestingWitness::<Projective> { e, w: W.w.clone() }, &U)
|
||||
|
.unwrap();
|
||||
|
}
|
||||
|
}
|
||||
@ -1,157 +0,0 @@ |
|||||
use std::marker::PhantomData;
|
|
||||
|
|
||||
/// Implements the scheme described in [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?view).
|
|
||||
/// Ova is a slight modification to Nova that shaves off 1 group operation and a few hashes.
|
|
||||
/// The key idea is that we can commit to $T$ and $W$ in one commitment.
|
|
||||
///
|
|
||||
/// This slightly breaks the abstraction between the IVC scheme and the accumulation scheme.
|
|
||||
/// We assume that the accumulation prover receives $\vec{w}$ as input which proves the current step
|
|
||||
/// of the computation and that the *previous* accumulation was performed correctly.
|
|
||||
/// Note that $\vec{w}$ can be generated without being aware of $\vec{t}$ or $\alpha$.
|
|
||||
/// Alternatively the accumulation prover can receive the commitment to $\vec{w}$ as input
|
|
||||
/// and add to it the commitment to $\vec{t}$.
|
|
||||
///
|
|
||||
/// This yields a commitment to the concatenated vector $\vec{w}||\vec{t}$.
|
|
||||
/// This works because both $W$ and $T$ are multiplied by the same challenge $\alpha$ in Nova.
|
|
||||
use ark_crypto_primitives::sponge::Absorb;
|
|
||||
use ark_ec::{CurveGroup, Group};
|
|
||||
use ark_ff::PrimeField;
|
|
||||
use ark_serialize::{CanonicalDeserialize, CanonicalSerialize};
|
|
||||
use ark_std::fmt::Debug;
|
|
||||
use ark_std::rand::RngCore;
|
|
||||
use ark_std::{One, UniformRand, Zero};
|
|
||||
|
|
||||
use crate::arith::r1cs::R1CS;
|
|
||||
use crate::commitment::CommitmentScheme;
|
|
||||
use crate::constants::NOVA_N_BITS_RO;
|
|
||||
use crate::folding::{circuits::CF1, traits::Dummy};
|
|
||||
use crate::transcript::{AbsorbNonNative, Transcript};
|
|
||||
use crate::Error;
|
|
||||
|
|
||||
pub mod nifs;
|
|
||||
|
|
||||
/// A CommittedInstance in [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?view) is represented by `W` or `W'`.
|
|
||||
/// It is the result of the commitment to a vector that contains the witness `w` concatenated
|
|
||||
/// with `t` or `e` + the public inputs `x` and a relaxation factor `mu`.
|
|
||||
#[derive(Debug, Clone, Eq, PartialEq, CanonicalSerialize, CanonicalDeserialize)]
|
|
||||
pub struct CommittedInstance<C: CurveGroup> {
|
|
||||
pub mu: C::ScalarField,
|
|
||||
pub x: Vec<C::ScalarField>,
|
|
||||
pub cmWE: C,
|
|
||||
}
|
|
||||
|
|
||||
impl<C: CurveGroup> Absorb for CommittedInstance<C>
|
|
||||
where
|
|
||||
C::ScalarField: Absorb,
|
|
||||
{
|
|
||||
fn to_sponge_bytes(&self, dest: &mut Vec<u8>) {
|
|
||||
C::ScalarField::batch_to_sponge_bytes(&self.to_sponge_field_elements_as_vec(), dest);
|
|
||||
}
|
|
||||
|
|
||||
fn to_sponge_field_elements<F: PrimeField>(&self, dest: &mut Vec<F>) {
|
|
||||
self.mu.to_sponge_field_elements(dest);
|
|
||||
self.x.to_sponge_field_elements(dest);
|
|
||||
// We cannot call `to_native_sponge_field_elements(dest)` directly, as
|
|
||||
// `to_native_sponge_field_elements` needs `F` to be `C::ScalarField`,
|
|
||||
// but here `F` is a generic `PrimeField`.
|
|
||||
self.cmWE
|
|
||||
.to_native_sponge_field_elements_as_vec()
|
|
||||
.to_sponge_field_elements(dest);
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
// Clippy flag needed for now.
|
|
||||
#[allow(dead_code)]
|
|
||||
/// A Witness in [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?view) is represented by `w`.
|
|
||||
/// It also contains a blinder which can or not be used when committing to the witness itself.
|
|
||||
#[derive(Debug, Clone, Eq, PartialEq, CanonicalSerialize, CanonicalDeserialize)]
|
|
||||
pub struct Witness<C: CurveGroup> {
|
|
||||
pub w: Vec<C::ScalarField>,
|
|
||||
pub rW: C::ScalarField,
|
|
||||
}
|
|
||||
|
|
||||
impl<C: CurveGroup> Witness<C> {
|
|
||||
/// Generates a new `Witness` instance from a given witness vector.
|
|
||||
/// If `H = true`, then we assume we want to blind it at commitment time,
|
|
||||
/// hence sampling `rW` from the randomness passed.
|
|
||||
pub fn new<const H: bool>(w: Vec<C::ScalarField>, mut rng: impl RngCore) -> Self {
|
|
||||
Self {
|
|
||||
w,
|
|
||||
rW: if H {
|
|
||||
C::ScalarField::rand(&mut rng)
|
|
||||
} else {
|
|
||||
C::ScalarField::zero()
|
|
||||
},
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
/// Computes the `W` or `W'` commitment (The accumulated-instance W' or the incoming-instance W)
|
|
||||
/// as specified in Ova. See: <https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?view#Construction>.
|
|
||||
///
|
|
||||
/// This is the result of concatenating the accumulated-instance `w` vector with
|
|
||||
/// `e` or `t`.
|
|
||||
/// Generates a [`CommittedInstance`] as a result which will or not be blinded depending on how the
|
|
||||
/// const generic `HC` is set up.
|
|
||||
///
|
|
||||
/// This is the exact trick that allows Ova to save up 1 commitment with respect to Nova.
|
|
||||
/// At the cost of loosing the PCD property and only maintaining the IVC one.
|
|
||||
pub fn commit<CS: CommitmentScheme<C, HC>, const HC: bool>(
|
|
||||
&self,
|
|
||||
params: &CS::ProverParams,
|
|
||||
t_or_e: Vec<C::ScalarField>,
|
|
||||
x: Vec<C::ScalarField>,
|
|
||||
) -> Result<CommittedInstance<C>, Error> {
|
|
||||
let cmWE = CS::commit(params, &[self.w.clone(), t_or_e].concat(), &self.rW)?;
|
|
||||
Ok(CommittedInstance {
|
|
||||
mu: C::ScalarField::one(),
|
|
||||
cmWE,
|
|
||||
x,
|
|
||||
})
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
impl<C: CurveGroup> Dummy<&R1CS<CF1<C>>> for Witness<C> {
|
|
||||
fn dummy(r1cs: &R1CS<CF1<C>>) -> Self {
|
|
||||
Self {
|
|
||||
w: vec![C::ScalarField::zero(); r1cs.A.n_cols - 1 - r1cs.l],
|
|
||||
rW: C::ScalarField::zero(),
|
|
||||
}
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
pub struct ChallengeGadget<C: CurveGroup> {
|
|
||||
_c: PhantomData<C>,
|
|
||||
}
|
|
||||
impl<C: CurveGroup> ChallengeGadget<C>
|
|
||||
where
|
|
||||
C: CurveGroup,
|
|
||||
<C as CurveGroup>::BaseField: PrimeField,
|
|
||||
<C as Group>::ScalarField: Absorb,
|
|
||||
{
|
|
||||
pub fn get_challenge_native<T: Transcript<C::ScalarField>>(
|
|
||||
transcript: &mut T,
|
|
||||
pp_hash: C::ScalarField, // public params hash
|
|
||||
// Running instance
|
|
||||
U_i: CommittedInstance<C>,
|
|
||||
// Incoming instance
|
|
||||
u_i: CommittedInstance<C>,
|
|
||||
) -> Vec<bool> {
|
|
||||
// NOTICE: This isn't following the order of the HackMD.
|
|
||||
// As long as we match it. We should not have any issues.
|
|
||||
transcript.absorb(&pp_hash);
|
|
||||
transcript.absorb(&U_i);
|
|
||||
transcript.absorb(&u_i);
|
|
||||
transcript.squeeze_bits(NOVA_N_BITS_RO)
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
// Simple auxiliary structure mainly used to help pass a witness for which we can check
|
|
||||
// easily an R1CS relation.
|
|
||||
// Notice that checking it requires us to have `E` as per [`Arith`] trait definition.
|
|
||||
// But since we don't hold `E` nor `e` within the NIFS, we create this structure to pass
|
|
||||
// `e` such that the check can be done.
|
|
||||
#[derive(Debug, Clone)]
|
|
||||
pub(crate) struct TestingWitness<C: CurveGroup> {
|
|
||||
pub(crate) w: Vec<C::ScalarField>,
|
|
||||
pub(crate) e: Vec<C::ScalarField>,
|
|
||||
}
|
|
||||
@ -1,482 +0,0 @@ |
|||||
/// This module contains the implementation of the Ova scheme NIFS (Non-Interactive Folding Scheme) as
|
|
||||
/// outlined in the protocol description doc: <https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction>
|
|
||||
/// authored by Benedikt Bünz.
|
|
||||
use ark_crypto_primitives::sponge::Absorb;
|
|
||||
use ark_ec::{CurveGroup, Group};
|
|
||||
use ark_std::One;
|
|
||||
use std::marker::PhantomData;
|
|
||||
|
|
||||
use super::{CommittedInstance, Witness};
|
|
||||
use crate::arith::r1cs::R1CS;
|
|
||||
use crate::commitment::CommitmentScheme;
|
|
||||
use crate::transcript::Transcript;
|
|
||||
use crate::utils::vec::{hadamard, mat_vec_mul, vec_scalar_mul, vec_sub};
|
|
||||
use crate::Error;
|
|
||||
|
|
||||
/// Implements all the operations executed by the Non-Interactive Folding Scheme described in the protocol
|
|
||||
/// spec by Bünz in the [original HackMD](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction).
|
|
||||
/// `H` specifies whether the NIFS will use a blinding factor
|
|
||||
pub struct NIFS<C: CurveGroup, CS: CommitmentScheme<C, H>, const H: bool = false> {
|
|
||||
_c: PhantomData<C>,
|
|
||||
_cp: PhantomData<CS>,
|
|
||||
}
|
|
||||
|
|
||||
impl<C: CurveGroup, CS: CommitmentScheme<C, H>, const H: bool> NIFS<C, CS, H>
|
|
||||
where
|
|
||||
<C as Group>::ScalarField: Absorb,
|
|
||||
{
|
|
||||
/// Computes the T parameter (Cross Terms) as in Nova.
|
|
||||
/// The wrapper is only in place to facilitate the calling as we need
|
|
||||
/// to reconstruct the `z`s being folded in order to compute T.
|
|
||||
pub fn compute_T(
|
|
||||
r1cs: &R1CS<C::ScalarField>,
|
|
||||
w_i: &Witness<C>,
|
|
||||
x_i: &[C::ScalarField],
|
|
||||
W_i: &Witness<C>,
|
|
||||
X_i: &[C::ScalarField],
|
|
||||
mu: C::ScalarField,
|
|
||||
) -> Result<Vec<C::ScalarField>, Error> {
|
|
||||
crate::folding::nova::nifs::NIFS::<C, CS, H>::compute_T(
|
|
||||
r1cs,
|
|
||||
C::ScalarField::one(),
|
|
||||
mu,
|
|
||||
&[vec![C::ScalarField::one()], x_i.to_vec(), w_i.w.to_vec()].concat(),
|
|
||||
&[vec![mu], X_i.to_vec(), W_i.w.to_vec()].concat(),
|
|
||||
)
|
|
||||
}
|
|
||||
|
|
||||
/// Computes the E parameter (Error Terms) as in Nova.
|
|
||||
/// The wrapper is only in place to facilitate the calling as we need
|
|
||||
/// to reconstruct the `z`s being folded in order to compute E.
|
|
||||
///
|
|
||||
/// Not only that, but notice that the incoming-instance `mu` parameter is always
|
|
||||
/// equal to 1. Therefore, we can save the some computations.
|
|
||||
pub fn compute_E(
|
|
||||
r1cs: &R1CS<C::ScalarField>,
|
|
||||
W_i: &Witness<C>,
|
|
||||
X_i: &[C::ScalarField],
|
|
||||
mu: C::ScalarField,
|
|
||||
) -> Result<Vec<C::ScalarField>, Error> {
|
|
||||
let (A, B, C) = (r1cs.A.clone(), r1cs.B.clone(), r1cs.C.clone());
|
|
||||
|
|
||||
let z_prime = [&[mu], X_i, &W_i.w].concat();
|
|
||||
// this is parallelizable (for the future)
|
|
||||
let Az_prime = mat_vec_mul(&A, &z_prime)?;
|
|
||||
let Bz_prime = mat_vec_mul(&B, &z_prime)?;
|
|
||||
let Cz_prime = mat_vec_mul(&C, &z_prime)?;
|
|
||||
|
|
||||
let Az_prime_Bz_prime = hadamard(&Az_prime, &Bz_prime)?;
|
|
||||
let muCz_prime = vec_scalar_mul(&Cz_prime, &mu);
|
|
||||
|
|
||||
vec_sub(&Az_prime_Bz_prime, &muCz_prime)
|
|
||||
}
|
|
||||
|
|
||||
/// Folds 2 [`CommittedInstance`]s returning a freshly folded one as is specified
|
|
||||
/// in: <https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction>.
|
|
||||
/// Here, alpha is a randomness sampled from a [`Transcript`].
|
|
||||
pub fn fold_committed_instance(
|
|
||||
alpha: C::ScalarField,
|
|
||||
// This is W (incoming)
|
|
||||
u_i: &CommittedInstance<C>,
|
|
||||
// This is W' (running)
|
|
||||
U_i: &CommittedInstance<C>,
|
|
||||
) -> CommittedInstance<C> {
|
|
||||
let mu = U_i.mu + alpha; // u_i.mu **IS ALWAYS 1 in OVA** as we just can do sequential IVC.
|
|
||||
let cmWE = U_i.cmWE + u_i.cmWE.mul(alpha);
|
|
||||
let x = U_i
|
|
||||
.x
|
|
||||
.iter()
|
|
||||
.zip(&u_i.x)
|
|
||||
.map(|(a, b)| *a + (alpha * b))
|
|
||||
.collect::<Vec<C::ScalarField>>();
|
|
||||
|
|
||||
CommittedInstance::<C> { cmWE, mu, x }
|
|
||||
}
|
|
||||
|
|
||||
/// Folds 2 [`Witness`]s returning a freshly folded one as is specified
|
|
||||
/// in: <https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction>.
|
|
||||
/// Here, alpha is a randomness sampled from a [`Transcript`].
|
|
||||
pub fn fold_witness(
|
|
||||
alpha: C::ScalarField,
|
|
||||
// incoming instance
|
|
||||
w_i: &Witness<C>,
|
|
||||
// running instance
|
|
||||
W_i: &Witness<C>,
|
|
||||
) -> Result<Witness<C>, Error> {
|
|
||||
let w: Vec<C::ScalarField> = W_i
|
|
||||
.w
|
|
||||
.iter()
|
|
||||
.zip(&w_i.w)
|
|
||||
.map(|(a, b)| *a + (alpha * b))
|
|
||||
.collect();
|
|
||||
|
|
||||
let rW = W_i.rW + alpha * w_i.rW;
|
|
||||
Ok(Witness::<C> { w, rW })
|
|
||||
}
|
|
||||
|
|
||||
/// fold_instances is part of the NIFS.P logic described in
|
|
||||
/// [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction)'s Construction section.
|
|
||||
/// It returns the folded [`CommittedInstance`] and [`Witness`].
|
|
||||
pub fn fold_instances(
|
|
||||
r: C::ScalarField,
|
|
||||
// incoming instance
|
|
||||
w_i: &Witness<C>,
|
|
||||
u_i: &CommittedInstance<C>,
|
|
||||
// running instance
|
|
||||
W_i: &Witness<C>,
|
|
||||
U_i: &CommittedInstance<C>,
|
|
||||
) -> Result<(Witness<C>, CommittedInstance<C>), Error> {
|
|
||||
// fold witness
|
|
||||
let w3 = NIFS::<C, CS, H>::fold_witness(r, w_i, W_i)?;
|
|
||||
|
|
||||
// fold committed instances
|
|
||||
let ci3 = NIFS::<C, CS, H>::fold_committed_instance(r, u_i, U_i);
|
|
||||
|
|
||||
Ok((w3, ci3))
|
|
||||
}
|
|
||||
|
|
||||
/// Implements NIFS.V (accumulation verifier) logic described in [Ova](https://hackmd.io/V4838nnlRKal9ZiTHiGYzw?both#Construction)'s
|
|
||||
/// Construction section.
|
|
||||
/// It returns the folded [`CommittedInstance`].
|
|
||||
pub fn verify(
|
|
||||
// r comes from the transcript, and is a n-bit (N_BITS_CHALLENGE) element
|
|
||||
alpha: C::ScalarField,
|
|
||||
// incoming instance
|
|
||||
u_i: &CommittedInstance<C>,
|
|
||||
// running instance
|
|
||||
U_i: &CommittedInstance<C>,
|
|
||||
) -> CommittedInstance<C> {
|
|
||||
NIFS::<C, CS, H>::fold_committed_instance(alpha, u_i, U_i)
|
|
||||
}
|
|
||||
|
|
||||
#[cfg(test)]
|
|
||||
/// Verify committed folded instance (ui) relations. Notice that this method does not open the
|
|
||||
/// commitments, but just checks that the given committed instances (ui1, ui2) when folded
|
|
||||
/// result in the folded committed instance (ui3) values.
|
|
||||
pub(crate) fn verify_folded_instance(
|
|
||||
r: C::ScalarField,
|
|
||||
// incoming instance
|
|
||||
u_i: &CommittedInstance<C>,
|
|
||||
// running instance
|
|
||||
U_i: &CommittedInstance<C>,
|
|
||||
// folded instance
|
|
||||
folded_instance: &CommittedInstance<C>,
|
|
||||
) -> Result<(), Error> {
|
|
||||
let expected = Self::fold_committed_instance(r, u_i, U_i);
|
|
||||
if folded_instance.mu != expected.mu
|
|
||||
|| folded_instance.cmWE != expected.cmWE
|
|
||||
|| folded_instance.x != expected.x
|
|
||||
{
|
|
||||
return Err(Error::NotSatisfied);
|
|
||||
}
|
|
||||
Ok(())
|
|
||||
}
|
|
||||
|
|
||||
/// Generates a [`CS::Proof`] for the given [`CommittedInstance`] and [`Witness`] pair.
|
|
||||
pub fn prove_commitment(
|
|
||||
r1cs: &R1CS<C::ScalarField>,
|
|
||||
tr: &mut impl Transcript<C::ScalarField>,
|
|
||||
cs_prover_params: &CS::ProverParams,
|
|
||||
w: &Witness<C>,
|
|
||||
ci: &CommittedInstance<C>,
|
|
||||
) -> Result<CS::Proof, Error> {
|
|
||||
let e = NIFS::<C, CS, H>::compute_E(r1cs, w, &ci.x, ci.mu).unwrap();
|
|
||||
let w_concat_e: Vec<C::ScalarField> = [w.w.clone(), e].concat();
|
|
||||
CS::prove(cs_prover_params, tr, &ci.cmWE, &w_concat_e, &w.rW, None)
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
#[cfg(test)]
|
|
||||
pub mod tests {
|
|
||||
use super::*;
|
|
||||
use crate::folding::ova::ChallengeGadget;
|
|
||||
use crate::transcript::poseidon::poseidon_canonical_config;
|
|
||||
use crate::{
|
|
||||
arith::{
|
|
||||
r1cs::tests::{get_test_r1cs, get_test_z},
|
|
||||
Arith,
|
|
||||
},
|
|
||||
folding::traits::Dummy,
|
|
||||
};
|
|
||||
use crate::{
|
|
||||
commitment::pedersen::{Params as PedersenParams, Pedersen},
|
|
||||
folding::ova::TestingWitness,
|
|
||||
};
|
|
||||
use ark_crypto_primitives::sponge::{
|
|
||||
poseidon::{PoseidonConfig, PoseidonSponge},
|
|
||||
CryptographicSponge,
|
|
||||
};
|
|
||||
use ark_ff::{BigInteger, PrimeField};
|
|
||||
use ark_pallas::{Fr, Projective};
|
|
||||
use ark_std::{test_rng, UniformRand, Zero};
|
|
||||
|
|
||||
fn compute_E_check_relation<C: CurveGroup, CS: CommitmentScheme<C, H>, const H: bool>(
|
|
||||
r1cs: &R1CS<C::ScalarField>,
|
|
||||
w: &Witness<C>,
|
|
||||
u: &CommittedInstance<C>,
|
|
||||
) where
|
|
||||
<C as Group>::ScalarField: Absorb,
|
|
||||
{
|
|
||||
let e = NIFS::<C, CS, H>::compute_E(r1cs, w, &u.x, u.mu).unwrap();
|
|
||||
r1cs.check_relation(&TestingWitness::<C> { e, w: w.w.clone() }, u)
|
|
||||
.unwrap();
|
|
||||
}
|
|
||||
|
|
||||
#[allow(clippy::type_complexity)]
|
|
||||
pub(crate) fn prepare_simple_fold_inputs<C>() -> (
|
|
||||
PedersenParams<C>,
|
|
||||
PoseidonConfig<C::ScalarField>,
|
|
||||
R1CS<C::ScalarField>,
|
|
||||
Witness<C>, // w
|
|
||||
CommittedInstance<C>, // u
|
|
||||
Witness<C>, // W
|
|
||||
CommittedInstance<C>, // U
|
|
||||
Witness<C>, // w_fold
|
|
||||
CommittedInstance<C>, // u_fold
|
|
||||
Vec<bool>, // r_bits
|
|
||||
C::ScalarField, // r_Fr
|
|
||||
)
|
|
||||
where
|
|
||||
C: CurveGroup,
|
|
||||
<C as CurveGroup>::BaseField: PrimeField,
|
|
||||
C::ScalarField: Absorb,
|
|
||||
{
|
|
||||
// Index 1 represents the incoming instance
|
|
||||
// Index 2 represents the accumulated instance
|
|
||||
let r1cs = get_test_r1cs();
|
|
||||
let z1 = get_test_z(3);
|
|
||||
let z2 = get_test_z(4);
|
|
||||
let (w1, x1) = r1cs.split_z(&z1);
|
|
||||
let (w2, x2) = r1cs.split_z(&z2);
|
|
||||
|
|
||||
let w = Witness::<C>::new::<false>(w1.clone(), test_rng());
|
|
||||
let W: Witness<C> = Witness::<C>::new::<false>(w2.clone(), test_rng());
|
|
||||
|
|
||||
let mut rng = ark_std::test_rng();
|
|
||||
let (pedersen_params, _) = Pedersen::<C>::setup(&mut rng, r1cs.A.n_cols).unwrap();
|
|
||||
|
|
||||
// In order to be able to compute the committed instances, we need to compute `t` and `e`
|
|
||||
// compute t
|
|
||||
let t = NIFS::<C, Pedersen<C>>::compute_T(&r1cs, &w, &x1, &W, &x2, C::ScalarField::one())
|
|
||||
.unwrap();
|
|
||||
// compute e (mu is 1 although is the running instance as we are "crafting it").
|
|
||||
let e = NIFS::<C, Pedersen<C>>::compute_E(&r1cs, &W, &x2, C::ScalarField::one()).unwrap();
|
|
||||
// compute committed instances
|
|
||||
// Incoming-instance
|
|
||||
let u = w
|
|
||||
.commit::<Pedersen<C>, false>(&pedersen_params, t, x1.clone())
|
|
||||
.unwrap();
|
|
||||
// Running-instance
|
|
||||
let U = W
|
|
||||
.commit::<Pedersen<C>, false>(&pedersen_params, e, x2.clone())
|
|
||||
.unwrap();
|
|
||||
|
|
||||
let poseidon_config = poseidon_canonical_config::<C::ScalarField>();
|
|
||||
let mut transcript = PoseidonSponge::<C::ScalarField>::new(&poseidon_config);
|
|
||||
|
|
||||
let pp_hash = C::ScalarField::from(42u32); // only for test
|
|
||||
|
|
||||
let alpha_bits = ChallengeGadget::<C>::get_challenge_native(
|
|
||||
&mut transcript,
|
|
||||
pp_hash,
|
|
||||
u.clone(),
|
|
||||
U.clone(),
|
|
||||
);
|
|
||||
let alpha_Fr = C::ScalarField::from_bigint(BigInteger::from_bits_le(&alpha_bits)).unwrap();
|
|
||||
|
|
||||
let (w_fold, u_fold) =
|
|
||||
NIFS::<C, Pedersen<C>, false>::fold_instances(alpha_Fr, &w, &u, &W, &U).unwrap();
|
|
||||
|
|
||||
// Check correctness of the R1CS relation of the folded instance.
|
|
||||
compute_E_check_relation::<C, Pedersen<C>, false>(&r1cs, &w_fold, &u_fold);
|
|
||||
|
|
||||
(
|
|
||||
pedersen_params,
|
|
||||
poseidon_config,
|
|
||||
r1cs,
|
|
||||
w,
|
|
||||
u,
|
|
||||
W,
|
|
||||
U,
|
|
||||
w_fold,
|
|
||||
u_fold,
|
|
||||
alpha_bits,
|
|
||||
alpha_Fr,
|
|
||||
)
|
|
||||
}
|
|
||||
|
|
||||
// fold 2 dummy instances and check that the folded instance holds the relaxed R1CS relation
|
|
||||
#[test]
|
|
||||
fn test_nifs_fold_dummy() {
|
|
||||
let mut rng = ark_std::test_rng();
|
|
||||
let r1cs = get_test_r1cs::<Fr>();
|
|
||||
|
|
||||
let w_dummy = Witness::<Projective>::dummy(&r1cs);
|
|
||||
let (pedersen_params, _) = Pedersen::<Projective>::setup(&mut rng, r1cs.A.n_cols).unwrap();
|
|
||||
|
|
||||
// In order to be able to compute the committed instances, we need to compute `t` and `e`
|
|
||||
// compute t
|
|
||||
let t = NIFS::<Projective, Pedersen<Projective>>::compute_T(
|
|
||||
&r1cs,
|
|
||||
&w_dummy,
|
|
||||
&[Fr::zero()],
|
|
||||
&w_dummy,
|
|
||||
&[Fr::zero()],
|
|
||||
Fr::one(),
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// compute e
|
|
||||
let e = NIFS::<Projective, Pedersen<Projective>>::compute_E(
|
|
||||
&r1cs,
|
|
||||
&w_dummy,
|
|
||||
&[Fr::zero()],
|
|
||||
Fr::one(),
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// dummy incoming instance, witness and public inputs
|
|
||||
let u_dummy = w_dummy
|
|
||||
.commit::<Pedersen<Projective>, false>(&pedersen_params, t, vec![Fr::zero()])
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// dummy accumulated instance, witness and public inputs
|
|
||||
let U_dummy = w_dummy
|
|
||||
.commit::<Pedersen<Projective>, false>(&pedersen_params, e.clone(), vec![Fr::zero()])
|
|
||||
.unwrap();
|
|
||||
|
|
||||
let w_i = w_dummy.clone();
|
|
||||
let u_i = u_dummy.clone();
|
|
||||
let W_i = w_dummy.clone();
|
|
||||
let U_i = U_dummy.clone();
|
|
||||
|
|
||||
// Check correctness of the R1CS relations of both instances.
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(&r1cs, &w_i, &u_i);
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(&r1cs, &W_i, &U_i);
|
|
||||
|
|
||||
// NIFS.P
|
|
||||
let r_Fr = Fr::from(3_u32);
|
|
||||
let (w_fold, u_fold) =
|
|
||||
NIFS::<Projective, Pedersen<Projective>>::fold_instances(r_Fr, &w_i, &u_i, &W_i, &U_i)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// Check correctness of the R1CS relation of both instances.
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(
|
|
||||
&r1cs, &w_fold, &u_fold,
|
|
||||
);
|
|
||||
}
|
|
||||
|
|
||||
// fold 2 instances into one
|
|
||||
#[test]
|
|
||||
fn test_nifs_one_fold() {
|
|
||||
let (pedersen_params, poseidon_config, r1cs, w, u, W, U, w_fold, u_fold, _, r) =
|
|
||||
prepare_simple_fold_inputs();
|
|
||||
|
|
||||
// NIFS.V
|
|
||||
let u_fold_v = NIFS::<Projective, Pedersen<Projective>>::verify(r, &u, &U);
|
|
||||
assert_eq!(u_fold_v, u_fold);
|
|
||||
|
|
||||
// Check that relations hold for the 2 inputted instances and the folded one
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(&r1cs, &w, &u);
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(&r1cs, &W, &U);
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(
|
|
||||
&r1cs, &w_fold, &u_fold,
|
|
||||
);
|
|
||||
|
|
||||
// check that folded commitments from folded instance (u) are equal to folding the
|
|
||||
// use folded rW to commit w_fold
|
|
||||
let e_fold = NIFS::<Projective, Pedersen<Projective>>::compute_E(
|
|
||||
&r1cs, &w_fold, &u_fold.x, u_fold.mu,
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
let mut u_fold_expected = w_fold
|
|
||||
.commit::<Pedersen<Projective>, false>(&pedersen_params, e_fold, u_fold.x.clone())
|
|
||||
.unwrap();
|
|
||||
u_fold_expected.mu = u_fold.mu;
|
|
||||
assert_eq!(u_fold_expected.cmWE, u_fold.cmWE);
|
|
||||
|
|
||||
// NIFS.Verify_Folded_Instance:
|
|
||||
NIFS::<Projective, Pedersen<Projective>>::verify_folded_instance(r, &u, &U, &u_fold)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// init Prover's transcript
|
|
||||
let mut transcript_p = PoseidonSponge::<Fr>::new(&poseidon_config);
|
|
||||
// init Verifier's transcript
|
|
||||
let mut transcript_v = PoseidonSponge::<Fr>::new(&poseidon_config);
|
|
||||
|
|
||||
// prove the u_fold.cmWE
|
|
||||
let cm_proof = NIFS::<Projective, Pedersen<Projective>>::prove_commitment(
|
|
||||
&r1cs,
|
|
||||
&mut transcript_p,
|
|
||||
&pedersen_params,
|
|
||||
&w_fold,
|
|
||||
&u_fold,
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// verify the u_fold.cmWE.
|
|
||||
Pedersen::<Projective>::verify(
|
|
||||
&pedersen_params,
|
|
||||
&mut transcript_v,
|
|
||||
&u_fold.cmWE,
|
|
||||
&cm_proof,
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
}
|
|
||||
|
|
||||
#[test]
|
|
||||
fn test_nifs_fold_loop() {
|
|
||||
let r1cs = get_test_r1cs();
|
|
||||
let z = get_test_z(3);
|
|
||||
let (w, x) = r1cs.split_z(&z);
|
|
||||
|
|
||||
let mut rng = ark_std::test_rng();
|
|
||||
let (pedersen_params, _) = Pedersen::<Projective>::setup(&mut rng, r1cs.A.n_cols).unwrap();
|
|
||||
|
|
||||
// prepare the running instance
|
|
||||
let mut W = Witness::<Projective>::new::<false>(w.clone(), &mut rng);
|
|
||||
// Compute e
|
|
||||
let e =
|
|
||||
NIFS::<Projective, Pedersen<Projective>>::compute_E(&r1cs, &W, &x, Fr::one()).unwrap();
|
|
||||
// Compute running `CommittedInstance`.
|
|
||||
let mut U = W
|
|
||||
.commit::<Pedersen<Projective>, false>(&pedersen_params, e, x)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
let num_iters = 10;
|
|
||||
for i in 0..num_iters {
|
|
||||
// prepare the incoming instance
|
|
||||
let incoming_instance_z = get_test_z(i + 4);
|
|
||||
let (w, x) = r1cs.split_z(&incoming_instance_z);
|
|
||||
let w = Witness::<Projective>::new::<false>(w, test_rng());
|
|
||||
let t =
|
|
||||
NIFS::<Projective, Pedersen<Projective>>::compute_T(&r1cs, &w, &U.x, &w, &x, U.mu)
|
|
||||
.unwrap();
|
|
||||
let u = w
|
|
||||
.commit::<Pedersen<Projective>, false>(&pedersen_params, t, x)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// Check incoming instance is Ok.
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(&r1cs, &w, &u);
|
|
||||
|
|
||||
// Generate "transcript randomness"
|
|
||||
let alpha = Fr::rand(&mut rng); // folding challenge would come from the RO
|
|
||||
|
|
||||
// NIFS.P
|
|
||||
let (w_folded, _) =
|
|
||||
NIFS::<Projective, Pedersen<Projective>>::fold_instances(alpha, &w, &u, &W, &u)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
// NIFS.V
|
|
||||
let u_folded = NIFS::<Projective, Pedersen<Projective>>::verify(alpha, &u, &U);
|
|
||||
|
|
||||
compute_E_check_relation::<Projective, Pedersen<Projective>, false>(
|
|
||||
&r1cs, &w_folded, &u_folded,
|
|
||||
);
|
|
||||
|
|
||||
// set running_instance for next loop iteration
|
|
||||
W = w_folded;
|
|
||||
U = u_folded;
|
|
||||
}
|
|
||||
}
|
|
||||
}
|
|
||||